The unbounded geography of cyber-conflict poses particular challenges to state sovereignty. Like certain other states, the United States has asserted that it is lawful to use force in self-defense against non-state actors in countries that either give the United States consent to do so or are “unwilling or unable” to suppress the threat themselves. This article explores how the “unwilling or unable” limitation should apply when a state seeks to respond to a cyber attack. Although the limitation remains relevant when a victim state suffers a cyber armed attack that is launched from the territory of a non-hostile state, the test’s application is complicated by problems of attribution, proliferation, and secrecy about cyber-capacities. Yet the “unwilling or unable” inquiry stands between the victim state and geographically-unbounded cyber-war, and must be taken seriously.
Ashley S. Deeks, The Geography of Cyber Conflict: Through a Glass Darkly, 89 International Law Studies 1–20 (2013).